rhsa-2021_1186
Vulnerability from csaf_redhat
Published
2021-04-14 16:34
Modified
2024-11-26 06:33
Summary
Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] 0-day security, bug fix, enhance

Notes

Topic
An update for org.ovirt.engine-root, ovirt-engine-ui-extensions, and ovirt-web-ui is now available for Red Hat Virtualization Engine 4.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The ovirt-engine package provides the manager for virtualization environments. This manager enables admins to define hosts and networks, as well as to add storage, create VMs and manage user permissions. Bug Fix(es): * Previously, saving user preferences in the Red Hat Virtualization Manager required the MANIPULATE_USERS permission level. As a result, user preferences were not saved on the server. In this release, the required permission level for saving user preferences was changed to EDIT_PROFILE, which is the permission level assigned by default to all users. As a result, saving user preferences works as expected. (BZ#1920539) A list of bugs fixed in this update is available in the Technical Notes book: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes Security Fix(es): * nodejs-bootstrap-select: not escaping title values on <option> may lead to XSS (CVE-2019-20921) * datatables.net: prototype pollution if 'constructor' were used in a data property name (CVE-2020-28458) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for org.ovirt.engine-root, ovirt-engine-ui-extensions, and ovirt-web-ui is now available for Red Hat Virtualization Engine 4.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The ovirt-engine package provides the manager for virtualization environments.\nThis manager enables admins to define hosts and networks, as well as to add\nstorage, create VMs and manage user permissions.\n\nBug Fix(es):\n* Previously, saving user preferences in the Red Hat Virtualization Manager required the MANIPULATE_USERS permission level. As a result, user preferences were not saved on the server.\nIn this release, the required permission level for saving user preferences was changed to EDIT_PROFILE, which is the permission level assigned by default to all users. As a result, saving user preferences works as expected. (BZ#1920539)\n\nA list of bugs fixed in this update is available in the Technical Notes\nbook:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes\n\nSecurity Fix(es):\n\n* nodejs-bootstrap-select: not escaping title values on \u003coption\u003e may lead to XSS (CVE-2019-20921)\n\n* datatables.net: prototype pollution if \u0027constructor\u0027 were used in a data property name (CVE-2020-28458)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:1186",
        "url": "https://access.redhat.com/errata/RHSA-2021:1186"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes"
      },
      {
        "category": "external",
        "summary": "1171924",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1171924"
      },
      {
        "category": "external",
        "summary": "1750426",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1750426"
      },
      {
        "category": "external",
        "summary": "1795457",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1795457"
      },
      {
        "category": "external",
        "summary": "1882273",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882273"
      },
      {
        "category": "external",
        "summary": "1908441",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908441"
      },
      {
        "category": "external",
        "summary": "1920539",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1920539"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1186.json"
      }
    ],
    "title": "Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] 0-day security, bug fix, enhance",
    "tracking": {
      "current_release_date": "2024-11-26T06:33:00+00:00",
      "generator": {
        "date": "2024-11-26T06:33:00+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2021:1186",
      "initial_release_date": "2021-04-14T16:34:35+00:00",
      "revision_history": [
        {
          "date": "2021-04-14T16:34:35+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-04-14T16:34:35+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-26T06:33:00+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
                "product": {
                  "name": "RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
                  "product_id": "8Base-RHV-S-4.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhev_manager:4.4:el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src",
                "product": {
                  "name": "ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src",
                  "product_id": "ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-ui-extensions@1.2.5-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-web-ui-0:1.6.8-1.el8ev.src",
                "product": {
                  "name": "ovirt-web-ui-0:1.6.8-1.el8ev.src",
                  "product_id": "ovirt-web-ui-0:1.6.8-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-web-ui@1.6.8-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-0:4.4.5.11-0.1.el8ev.src",
                "product": {
                  "name": "ovirt-engine-0:4.4.5.11-0.1.el8ev.src",
                  "product_id": "ovirt-engine-0:4.4.5.11-0.1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine@4.4.5.11-0.1.el8ev?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch",
                  "product_id": "ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-ui-extensions@1.2.5-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-web-ui-0:1.6.8-1.el8ev.noarch",
                "product": {
                  "name": "ovirt-web-ui-0:1.6.8-1.el8ev.noarch",
                  "product_id": "ovirt-web-ui-0:1.6.8-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-web-ui@1.6.8-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-backend-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-backend-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-backend-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-backend@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-dbscripts-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-dbscripts-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-dbscripts-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-dbscripts@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-health-check-bundler-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-health-check-bundler-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-health-check-bundler-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-health-check-bundler@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-restapi-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-restapi-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-restapi-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-restapi@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-setup-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-setup-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-setup-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-setup@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-setup-base-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-setup-base-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-setup-base-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-setup-base@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-setup-plugin-cinderlib-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-cinderlib@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-setup-plugin-imageio-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-setup-plugin-imageio-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-setup-plugin-imageio-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-imageio@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-ovirt-engine@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-ovirt-engine-common@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-vmconsole-proxy-helper@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-websocket-proxy@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-tools-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-tools-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-tools-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-tools@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-tools-backup-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-tools-backup-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-tools-backup-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-tools-backup@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-vmconsole-proxy-helper@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-webadmin-portal-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-webadmin-portal-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-webadmin-portal-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-webadmin-portal@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-engine-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "ovirt-engine-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "ovirt-engine-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-engine-websocket-proxy@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-ovirt-engine-lib-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "python3-ovirt-engine-lib-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "python3-ovirt-engine-lib-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-ovirt-engine-lib@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhvm-0:4.4.5.11-0.1.el8ev.noarch",
                "product": {
                  "name": "rhvm-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_id": "rhvm-0:4.4.5.11-0.1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhvm@4.4.5.11-0.1.el8ev?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-0:4.4.5.11-0.1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.11-0.1.el8ev.src"
        },
        "product_reference": "ovirt-engine-0:4.4.5.11-0.1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-backend-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-backend-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-dbscripts-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-dbscripts-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-health-check-bundler-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-health-check-bundler-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-restapi-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-restapi-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-setup-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-setup-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-setup-base-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-setup-base-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-setup-plugin-cinderlib-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-setup-plugin-imageio-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-setup-plugin-imageio-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-tools-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-tools-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-tools-backup-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-tools-backup-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src"
        },
        "product_reference": "ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-webadmin-portal-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-webadmin-portal-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-engine-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "ovirt-engine-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-web-ui-0:1.6.8-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.8-1.el8ev.noarch"
        },
        "product_reference": "ovirt-web-ui-0:1.6.8-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-web-ui-0:1.6.8-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.8-1.el8ev.src"
        },
        "product_reference": "ovirt-web-ui-0:1.6.8-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-ovirt-engine-lib-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "python3-ovirt-engine-lib-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhvm-0:4.4.5.11-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
          "product_id": "8Base-RHV-S-4.4:rhvm-0:4.4.5.11-0.1.el8ev.noarch"
        },
        "product_reference": "rhvm-0:4.4.5.11-0.1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-S-4.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-20921",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2020-09-24T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.11-0.1.el8ev.src",
            "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.8-1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.8-1.el8ev.src",
            "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:rhvm-0:4.4.5.11-0.1.el8ev.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1882273"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim\u0027s browser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nodejs-bootstrap-select: not escaping title values on \u003coption\u003e may lead to XSS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Service Mesh (OSSM) the openshift-service-mesh/kiali-rhel7 container (which installs the kiali rpm) is behind OpenShift OAuth authentication restricting access to the vulnerable bootstrap-select library to authenticated users only, therefore the impact is low.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src"
        ],
        "known_not_affected": [
          "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.11-0.1.el8ev.src",
          "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.8-1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.8-1.el8ev.src",
          "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:rhvm-0:4.4.5.11-0.1.el8ev.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-20921"
        },
        {
          "category": "external",
          "summary": "RHBZ#1882273",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882273"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-20921",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-20921"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20921",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20921"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-9r7h-6639-v5mw",
          "url": "https://github.com/advisories/GHSA-9r7h-6639-v5mw"
        },
        {
          "category": "external",
          "summary": "https://snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457",
          "url": "https://snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457"
        }
      ],
      "release_date": "2019-02-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-04-14T16:34:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
          "product_ids": [
            "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:1186"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nodejs-bootstrap-select: not escaping title values on \u003coption\u003e may lead to XSS"
    },
    {
      "cve": "CVE-2020-28458",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2020-12-16T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.11-0.1.el8ev.src",
            "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.8-1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.8-1.el8ev.src",
            "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.11-0.1.el8ev.noarch",
            "8Base-RHV-S-4.4:rhvm-0:4.4.5.11-0.1.el8ev.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1908441"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "datatables.net: prototype pollution if \u0027constructor\u0027 were used in a data property name",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift console container does package a vulnerable version of datatables.net, however as access to the vulnerable component is restricted via OpenShift OAuth the vulnerability is rated with an impact of `Low`.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src"
        ],
        "known_not_affected": [
          "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.11-0.1.el8ev.src",
          "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.8-1.el8ev.noarch",
          "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.8-1.el8ev.src",
          "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.11-0.1.el8ev.noarch",
          "8Base-RHV-S-4.4:rhvm-0:4.4.5.11-0.1.el8ev.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-28458"
        },
        {
          "category": "external",
          "summary": "RHBZ#1908441",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908441"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28458",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-28458"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28458",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28458"
        },
        {
          "category": "external",
          "summary": "https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402",
          "url": "https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402"
        }
      ],
      "release_date": "2020-10-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-04-14T16:34:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
          "product_ids": [
            "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:1186"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.noarch",
            "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.5-1.el8ev.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "datatables.net: prototype pollution if \u0027constructor\u0027 were used in a data property name"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.